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A SYSTEM AND METHOD FOR VERIFYING THE INTEGRITY OF 
STORED INFORMATION WITHIN AN ELECTRONIC DEVICE 



1. Field 

5 The present invention relates to the field of data security. More 

particularly, this invention relates to a scheme for verifying the integrity of stored 
information loaded within an electronic device. 



2. General Background 

1 0 Many electronic devices include a set of semi-permanently stored 

instructions referred to as firmv/are. For instance, computers include a type of 
firmware referred to as the basic input/output system (BIOS). Being executed by a 
processor of the computer, the BIOS is coded to perform various functions. For 
example, during a pre-boot cycle at power-up, the BIOS controls the initialization 

15 of the computer as well as the initialization of various hardware peripherals. 

Normally provided by a single vendor, the BIOS is loaded into pre-boot space of a 
non-volatile memory such as a read-only memory (ROM) component or a flash 
memory component during manufacture of the computer. 

Recently, however, it has become desirable to store more sophisticated 

20 routines and data in the pre-boot space of the non-volatile memory. As an 
example, in recent efforts to protect against software viruses and malicious 
corruption of the BIOS, an image of the BIOS code may be digitally signed to 
produce a digital signature. Prior to execution of the BIOS, the digital signature 
may be used to determine whether the BIOS has been modified. This provides 

25 much needed virus protection. 

Well known in the art, a digital signature is digital data signed using a 
private key of its signatory. Similar to encryption, the "signing process" maybe 
accomplished using any of a number of software algorithms such as a Rivert 
Shamir and Adleman (RSA) algorithm or the Digital Signature Algorithm (DSA) 

30 as set forth in a Federal Information Processing Standards publication 186 entitled 
"Digital Signature Standard" (May 19, 1994). Normally, the digital data is placed 
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in an encoded form (referred to as the "hash value"), achieved by performing a 
one-way hash operation on the original digital data, prior to signing the hash 
value. The term "one-way" indicates that there does not readily exist an inverse 
operation or function to recover any discernible portion of the digital data from the 
5 hash value. 

Recently, the computer industry has made efforts to develop BIOS as a 
collection of software modules produced by different vendors rather than a piece 
of monolithic code produced by a single vendor. It is likely that the code of the 
BIOS modules would be configured as "execute-in-place" modules because this 

1 0 code would be executed before the availability of system random access memory 
(RAM). Also, it is likely that relocation would be used to properly load the BIOS 
modules within the non- volatile memory because it would be too difficult for all 
of the BIOS vendors to agree on the specific addressing scheme beforehand. 

As commonly known in the industry, "relocation" is a process by which 

1 5 addresses within each BIOS module are adjusted based on the particular address 
location in memory allotted for the BIOS module (referred to as the "base 
address"). Thus, software routines within a BIOS module are usually coded with 
relative offsets from a base address that has not yet been assigned. During 
relocation, the addresses of various software routines within the BIOS module 

20 would be adjusted by adding the base address to each of the relative offsets. 

Unfortunately, if relocation is performed on the execute-in-place BIOS 
modules, any digital signatures associated with the images of the BIOS modules 
would be ineffective because any data integrity analysis using the digital 
signatures would indicate that the BIOS module has been modified. Hence, it is 

25 virtually impossible to determine whether modification of the BIOS module was 
unauthorized or merely due to the relocation operation. Thus, it would be 
desirable to develop an integrity verification mechanism that improves the 
effectiveness of digital signatures in detecting unauthorized modifications to the 
BIOS module while still allowing the image to undergo relocation. 

30 Moreover, when BIOS is developed as a collection of digitally signed 

BIOS modules produced by different vendors, in certain situations, it may be 
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desirable to dynamically link these digitally signed modules. In particular, one 
BIOS module may be configured to make a call for a function coded in another 
BIOS module. However, in order to dynamically link the BIOS modules together, 
it would require modification of at least one BIOS module, which would 
5 invalidate any digital signature associated with the image of that BIOS module. 
Thus, the original digital signatures would not be effective to identifying 
unauthorized modification of the module. Thus, an integrity verification 
mechanism that overcomes this problem would be desirable. 



BRIEF DESCRIPTION OF THE DRAWINGS 

The features and advantages of the present invention will become apparent 
firom the following detailed description of the present invention in which: 

Figure 1 is an illustrative block diagram of a collection of software 
modules for loading as firmware into an electronic device. 

Figure 2 is an illustrative block diagram of an embodiment of an electronic 
device utilizing the present invention. 

Figure 3 is a block diagram of a first illustrative embodiment of the 
contents of the non- volatile memory component of Figure 2 that are collectively 
used to verify the integrity of relocated, post-relocation images using digital 
signatures. 

Figure 4 is a block diagram of a second illustrative embodiment of the 
contents of the non- volatile memory component of Figure 2. 

Figure 5 is a flowchart of the operations for verifying the integrity of 
stored information, such as a post-relocation image shown in Figures 3 and 4. 

Figure 6 is a block diagram of a second illustrative embodiment of the 
present invention featuring a plurality of digitally signed images are dynamically 
linked together through one or more Boimd & Relocated Import Tables (BRITs). 

Figure 7 is a flowchart of the operations for generating a Bound and 
Relocated Import Table (BRIT). 

Figure 8 is a flowchart of the operations for verifying the Bound and 
Relocated hnport Table (BRIT) of Figure 7. 
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DETAILED DESCRIPTION OF THE INVENTION 
Herein, certain embodiments of the invention are described for verifying 
the integrity of information that is stored within an electronic device during pre- 
5 boot operations. In general, the stored information may include, for example, a 
digitally signed image that includes a post-relocation image of a software module 
or is dynamically linked with another digitally signed image. 

In the following description, certain terminology is used to discuss features 
of the present invention. A "software module" comprises a set of instructions that 

10 perform a particular fimction. For example, the software module may feature 
instructions that are executed during a pre-boot cycle in order to initialize an 
electronic device. A rephcation of a binary representation of the instructions 
associated with the software module is referred to as an "image". Different types 
of images can be used to represent different formatting stages. For instance, a 

1 5 "pre-relocation image" is a binary representation of the software module prior to 
conducting a relocation operation thereon. A "post-relocation image" is a binary 
representation of the module after relocation. 

Furthermore, an "electronic device" is a combination of electronic 
hardware and software that collectively operates to perform one or more specific 

20 functions. Examples of an electronic device include a computer (e.g., a laptop, 

desktop, hand-held, server, mainframe, etc.), a component of the computer (e.g., a 
serial port), a cellular telephone, a set-top box (cable box, network computer, 
satellite television receiver, etc.), a network apphance and the hke. A "link" is 
broadly defined as one or more information-carrying mediums to establish a 

25 communication pathway, including physical mediiun (e.g., electrical wire, optical 
fiber, cable, bus traces, etc.) or wireless medium (e.g., air in combination with 
wireless signaling technology). 

Briefly, one integrity verification mechanism involves the configuration of 
a digitally signed image to include relocation information, a post-relocation image 

30 and a digital signature. The "relocation information" is a series of relative offsets 
from a base address. These offsets are generated after the stored information (e.g., 
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an image of a software module) is compiled and placed into an executable format 
such as an MS-DOS® "EXE" format (MS-DOS is a registered trademark of 
Microsoft Corporation of Redmond, Washington). The offsets are converted to 
appropriate addresses during relocation when the base address, namely the storing 
address at which the image of the software module is stored and retrieved for 
execution, is determined. Thus, the post-relocation image differs from a pre- 
relocation image. The digital signature, however, is based on the pre-relo cation 
image. 

Another second integrity verification mechanism involves the inclusion of 
an import table and an export table within each digitally signed image. These 
tables allow fimctions within different digitally signed images to be dynamically 
bound together via a Bound & Relocated Import Table (BRIT). The BRIT resides 
outside the digitally signed image. Both of the integrity verification mechanisms 
may be performed by hardware or a software program embedded in a processor 
(described below) or simply executable by the processor. 

Referring to Figure 1, an illustrative block diagram of a collection of "N" 
software modules ready for loading as firmware 100 into an electronic device is 
shown. Herein, each software module 1 IOn (N>1) includes a header 120n and an 
image 130n for a particular software segment of the firmware lOO. Prior to 
loading the software modules as firmware into a non- volatile memory as described 
below, each image 130n is digitally signed by a signatory to produce a digital 
signature 140n. The signatories may differ between each module or multiple 
modules may share the same signatory. A "signatory" may include any person or 
entity in a position of trust to guarantee or sponsor the digital signature (e.g., a 
bank, govenmiental entity, trade association, original equipment manufacturer, 
vendor, etc.). 

Referring now to Figure 2, an illustrative block diagram of an embodiment 
of an electronic device is shown. For this embodiment, the electronic device 200 
comprises a chipset 210 coupled to a processor 220 and a memory 230 through a 
first bus 240 and a second bus 250, respectively. In addition, chipset 210 is 
coupled to a third bus 260 that provides a pathway to one or more system 
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resources 270. Herein, the third bus 260 is represented as an input/output (I/O) 
bus (e.g., Peripheral Component hiterconnect "PCI" bus); however, any other type 
of bus architecture may be used, including such bus architectures as Industry 
Standard Architecture (ISA), Extended ISA (EISA), Universal Serial Bus (USB) 
and the like. Herein, the third bus 260 is shown as a single bus, but it is 
contemplated that the third bus 260 may include multiple buses coupled together 
through bridge circuitry. 

As shown, the system resources 270 would be coupled to at least one of 
the multiple buses. The system resources 270 comprise a communication device 
280 and a non- volatile memory component 290. Communication device 280 is 
configured to establish communications with another electronic device over a 
communication link 285. Examples of communication device 280 include a 
network interface card, a modem card or an external modem. The non- volatile 
memory component 290 includes firmware that features digitally signed images of 
one or more software modules. In one embodiment, one or more of these software 
modules may form a Basic Input/Output System (BIOS) code of the electronic 
device 200. Examples of the non-volatile memory component 290 include a 
programmable, non-volatile memory such as flash memory, battery-backed 
random access memory (RAM), read only memory (ROM), erasable 
programmable ROM (EPROM), electrically erasable PROM (EEPROM), or any 
other type of memory appropriate for storing the module(s). 

Referring to Figure 3, a block diagram of a first illustrative embodiment of 
the loading and storage contents of the non- volatile memory component 290 of 
Figure 2 is shown. The non-volatile memory component 290 is loaded with one 
or more digitally signed images 300, which collectively act as firmware. With 
respect to this embodiment, a digitally signed image 300 includes relocation 
information 310, a pre-relocation image 320 and a digital signature 330. The 
positioning of the elements forming any image is a design choice. 

The relocation information 310 includes relative offsets 315 for certain 
routines within the pre-relocation image 310. Normally, the offsets 315 are 
generated when the software module associated with the digitally signed image is 
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compiled. The offsets 315 are used for properly addressing segments of 
information within the software module during relocation once the starting 
location of the image 300, referred to as base address "B_ADDR," is determined. 
The relocation is conducted by a symmetrical relocation fiinction that allows the 
relocated information to be undone for data integrity verification using the digital 
signature 330. 

Herein, during relocation, the pre-relocation image 320 is converted 
(relocated) to a post-relocation image 340 is based on the pre-relocation image 
320 of the image 300 during loading. Namely, the pre-relocation image 320 is 
relocated for retrieval from the base address (B_ADDR) allotted to the image 300. 
hi essence, the relocation operation adds B_ADDR to the offsets 315 contained 
within the relocation information 310. This modifies the binary image such as the 
post-relocation image 340 stored in the non-volatile memory component now 
differs fi-om the pre-relocation image 320 coded by the vendor. 

The digital signature 330 includes at least a hash value of the pre-relocation 
image 320, which is digitally signed with a private key (PRK) of a signatory. 
Although the post-relocation image 340 now resides in the non- volatile memory 
component after relocation, it is appreciated that the digital signature 330 is based 
on the pre-relocated image 320 which is the binary form as originally produced 
before loading into the non-volatile memory component. 

Referring to Figure 4, a block diagram of a second illustrative embodiment 
of the contents of the non- volatile memory component 290 is shown. The non- 
volatile memory component 290 contains multiple digitally signed images 41 Oi- 
4 10m ("M" being a positive whole number) forming the firmware 400 (e.g., the 
BIOS). For instance, as an illustrative example, each digitally signed image 410i- 
410m is formed with a pre-relocation image 420i-420m, relocation information 
430i-430m and a digital signature 440i-440m. Each digital signature 400i-400m is 
based on at least a hash value of its corresponding pre-relocation image 420i-420m 
and is digitally signed with a private key (PRK) of one or more signatories. Upon 
being loaded with the digitally signed images 410i-410m, the non- volatile memory 
component 290 undergoes a relocation operation which modifies the stored images 
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from the pre-relocation images 420i-420m to a post-relocation images 450i-450m, 
respectively. 

Referring now to Figure 5, a flowchart of the operations for verifying the 
integrity of stored information, such as a post-relocation image of Figures 3 and 4, 
is shown. For integrity verification, the post-relocation image of a digitally signed 
image is reconverted to a pre-relocation image (block 500). This is accomplished 
using the relocation information contained in the digitally signed image. In 
particular, one or more arithmetic operations are performed on each offset; namely, 
as an example, the base address associated with memory of ,tlie non- volatile 
memory component is subtracted from each offset set forth in the relocation 
information. Thereafter, in block 510, a hash operation is p^^formed on the 
reconverted, pre-relocation image to produce a hash value (referred to as the 
"reconverted hash value"). 

The digital signature of the digitally signed image is accessed and the hash 
value of the digital signature is recovered (block 520). This may be accomphshed 
by running the digitally signed image through the digital signature algorithm being 
provided with a public key of the signatory for decode purposes. Thereafter, the 
recovered hash value is compared to the reconverted hash value (block 530). If a 
match is determined, the post-relocation image has been verified (block 540). 
Otherwise, the post-relocation image has not been verified, indicating that the 
image has been modified beyond such modification caused by relocation (block 
550). 

Figure 6 is a block diagram of a second illustrative embodiment of the 
present invention in which a plurality (M) of digitally signed images 600] -600m 
are dynamically linked together through one or more Bound & Relocated Import 
Tables (BRITs). Each BRIT corresponds to only one digitally signed image. It is 
contemplated that each digitally signed image 600i-600m may include a BRIT or 
only a subset of the digital signed images 600i-600m may be provided BRITs. 

In this embodiment, a dynamic linking of two digitally signed images 600i 
and 600m is shown. Herein, the digitally signed image 600i includes a BRIT 610i, 
an import table 620i, an export table 630i, an image 640i based on selected 
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information (e.g., a software module) and a digital signature 650i. The digital 
signature 650i is generated by conducting a one-way hash operation on the import 
table 620i, the export table 630i and the image 640i to produce a resultant hash 
value. The resultant hash value is digitally signed by a signatory using its private 
key. 

hi general, the import table 620 1 is listing of stored irtformation located in 
another digitally signed image (e.g., image 640m) that need td be accessed for 
proper execution of the image 640 1. The import table 620i comprises a plurality 
of entries 625 of which at least one entry (e.g., entry 626) of the import table 620 
comprises an identifier 627 and a first offset 628. Generated either internally 
within the electronic device or remotely by a centralized authority, the identifier 
627 indicates what segment(s) of information (e.g., a function, routine, code, data, 
etc.) not contained within the digitally signed image 600i, is required by the image 
640i during execution. The identifier 627 may be represented as an alphanumeric 
name or a guaranteed unique identification (e.g., a sixteen-byte value). The first 
offset 628 is an offset pointer to an entry of the BRIT 610 that corresponds to 
entry 626. 

The export table 630 is a listing of information contained in a digitally 
signed image that are available for other digitally signed images to retrieve. 
Entries of the export table 630m, for example, include an identifier 635 for each 
segment of information included in the image 640m and a second offset 636. The 
second offset 636 is equivalent to an offset from an address location of the 
digitally signed image 600m to the address location of the segment of information 
required by image 640] of the digitally signed image 600i. 

As shown, the BRIT 610i is associated with the digitally signed image 
600i. Each entry of the BRIT 610i includes the identifier 627 and an address 
pointer 611 of the location of the segment of information. The address pointer 
61 1 is an arithmetic combination of the starting address of the image 640m and the 
second offset 636. Thus, during execution of image 600i, a request for a segment 
of information referenced by the identifier 627 is routed via the BRIT 610i to a 
location within the image 640m as represented by dashed line 660. This enables 
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the segment of information at that location to be accessed without modification of 
the image 640m. Thus, the digital signatures 650i and 650m can still be used to 
monitor modification of the import tables 620i and 620m, export tables 63 Oi and 
630m, and/or images 640i and 640m. 

Referring now to Figure 7, a flowchart of the operations for generating a 
Bound and Relocated Import Table (BRIT) of the first digitally signed image 600, 
of Figure 6 is shown. Liitially, all digitally signed images within the non-volatile 
memory component are located (block 700). Thereafter, an import table of the 
first digitally signed image is located (block 710). For an initial entry of the 
import table, the identifier is determined and a search is conducted for a matching 
identifier in an export table of another digitally signed images, namely any other 
digitally signed image besides the first digitally signed image (blocks 720 and 
730). 

If the matching identifier is not located, an error is reported (blocks 740 
and 750). If the matching identifier is located within a second digitally signed 
image, for example, the offset in the export table that corresponds to the matching 
identifier and resides in second digitally signed image is arithmetically combined 
with the starting address of the second digitally signed image (blocks 740 and 
760). The combined address is loaded into an entry of the BRIT along with the 
identifier associated with the import table (block 770). This process continues 
until all entries in the import table have corresponding entiies in the BRIT (block 
780). 

Referring to Figure 8, a flowchart of the operations for verifying the Bound 
and Relocated Import Table (BRIT) of Figure 7 is shown. In this embodiment, a 
list of all digitally signed images is generated (block 800). For each digitally 
signed image, verify the integrity of these digitally signed images by confirming 
that its corresponding import table, export table and image have not been modified 
(block 810). For a first digitally signed image, for example, this can be 
accomplished by performing a hash operation on the import table, export table and 
image of the first digitally signed image. This produces a resultant hash value. 
The resultant hash value is compared with a hash value uncovered fi-om the digital 
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signature associated with the first digitally signed image. If the resultant hash 
value matches the recovered hash value, the import table, export table and image 
for the first digitally signed image have not been modified. This operation is 
continued for all of the remaining digitally signed images. 

If the integrity of the digitally signed images cannot be verified, an error is 
reported (block 820). Otherwise, for the first digitally signed image, a 
determination is made whether the identifier in its import table matches an 
identifier in an export table of another digitally signed image (block 830). If no 
match is located, an error is reported (see block 820). If a match is located, a 
determination is made whether the BRIT entry corresponding to the identifier of 
the import table points to an address defined by the matching identifier of the 
export table of another digitally signed image (block 840). Since the BRIT can 
only point to an address defined by an export table that is contained in a digitally 
signed image, it can only point to trusted information. If the BRIT entry 
corresponding to the identifier of the import table points to an address defined by 
the matching identifier of the export table of another digitally signed image, the 
BRIT is verified (block 850). Otherwise, the BRIT is not verified (block 860). 

While certain exemplary embodiments have been described and shown in 
the accompanying drawings, it is to be understood that such embodiments are 
merely illustrative of and not restrictive on the broad invention, and that this 
invention not be limited to the specific constructions and arrangements shown and 
described, since various other modifications may occur to those ordinarily skilled 
in the art. 
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CLAIMS 

What is claimed is: 



1 1 . Embodied in a memory component, a digitally signed image comprising: 

2 a post-relocation image being an image of a software module altered by a 

3 symmetrical relocation function upon loading of the image into the memory component; 

4 and 

5 a digital signature based on the image. 

1 2. The digitally signed image of claim 1 , wherein the digital signature is a 

2 hash value of the image digitally signed by a private key of a selected signatory. 

1 3. The digitally signed image of claim 1 further comprising information for 

2 use by the symmetrical relocation function to convert the image into the relocation image. 

1 4. The digitally signed image of claim 3, wherein the information includes 

2 offsets for routines within the software module. 

1 5. The digitally signed image of claim 4, wherein the offsets are generated 

2 when the software module is compiled. 

1 6. Embodied in a memory component, a digitally signed image comprising: 

2 a Bound & Relocated hnport Table (BRIT); 

3 an import table; 

4 an export table; 

5 an image of a software module; and 

6 a digital signature based on the import table, the export table and the image. 
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1 7. The digitally signed image of claim 6, wherein the import table comprises 

2 a plurality of entries, each entry includes an identifier that indicates what segment of 

3 information contained in another digitally signed image is required by the image. 

1 8. The digitally signed image of claim 7, wherein the identifier includes a 

2 unique sequence of byte values. 

1 9. The digitally signed image of claim 7, wherein the identifier includes a 

2 unique sequence of alphanumeric characters. 

1 10. The digitally signed image of claim 7, wherein each entry of the import 

2 table further includes an offset to a corresponding entry of the BRIT. 

1 11. The digitally signed image of claim 6, wherein the export table includes a 

2 pliirality of entries forming a listing of segments of information contained in the image, a 

3 selected entry of the plurality of entries includes an identifier of a segment of information 

4 associated with the segments of information. 

1 12. The digitally signed image of claim 1 1 , wherein the selected entry further 

2 includes a second offset being an offset from a starting address of the digitally signed 

3 image to an address location of the segment of information. 

1 13. A method comprising: 

2 reconverting a post-relocation image of a digitally signed image back to a pre- 

3 relocation image, the pre-relocation image being an image of a software module prior to 

4 be altered by a symmetrical relocation function; 

5 conducting a hash operation on the reconverted, pre-relocation image to produce a 

6 reconverted hash value; 
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7 recovering a hash value from a digital signature contained in the digitally signed 

8 image, the hash value is based on the image of the software module; and 

9 comparing the hash value to the reconverted hash value. 

1 14. Themethodof claim 13 further comprising: -^y- 

2 determining that an integrity of the post-relocation image remains intact if the 

3 hash value matches the reconverted hash value. 

1 15. The method of claim 13 further comprising: 

2 determining that the post-relocation image has been modified beyond any 

3 modification caused by relocation when the hash value fails to match the reconverted 

4 hash value. 

1 16. The method of claim 13, wherein the hash operation is a one-way hash 

2 operation. 

1 1 7. A method for generating a Bound & Relocated Import Table (BRIT) 

2 within an electronic device, comprising: 

3 (a) locating an import table for a first digitally signed image loaded within the 

4 electronic device, each entry of the import table including an identifier and a first offset; 

5 (b) accessing an identifier within a selected entry of the first digitally signed image; 

6 (c) determining whether the identifier matches an identifier within an export table 

7 of a second digitally signed image loaded within the electronic device, the identifier for 

8 the export table is stored with a corresponding second offset; and 

9 (d) upon determining that the identifier within the selected entry matches the 

10 identifier within the export table, 

1 1 producing an address by combining the second offset with a starting 

12 address of the second digitally signed image, and 

13 loading the identifier within the selected entry and the address into an 

14 entry of the BRIT. 
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1 18. The metho d of claim 1 7 further comprising : 

2 repeating the operations of (a)-(d) for each remaining entry of the import table for 

3 loading resultant address and identifier pairs into different entries of the BRIT. 

1 19. The method of claim 1 7, wherein the producing of the address by 

2 combining the second offset with the starting address of the second digitally signed image 

3 comprises an arithmetic operation. 

1 20. The method of claim 17, wherein prior to locating an import table for the 

2 first digitally signed image, the method further comprises locating a plurality of digitally 

3 signed images loaded within the electronic device. 

1 2 1 . A method comprising: 

2 verifying an integrity of a plurality of digitally signed images loaded in an 

3 electronic device, the plurality of digitally signed images includes a first digitally signed 

4 image and a second digitally signed image; 

5 determining whether an identifier in an import table of the first digitally signed 

6 image matches an identifier in an export table of the second digitally signed image; and 

7 determining whether an entry of a Bound & Relocated hnport Table (BRIT) 

8 corresponding to the identifier in the import table points to an address defined by the 

9 identifier in the export table. 

1 22. The method of claim 2 1 , wherein the verifying the integrity of the plurality 

2 of digitally signed images includes 

3 performing a hash operation on the import table, the export table and an image of 

4 the first digitally signed image to produce a first resultant hash value; 

5 recovering a first hash value from a digital signature contained in the first digitally 

6 signed image; and 

7 comparing the first hash value with the first resultant hash value. 
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1 23 . The method of claim 22, wherein the verifying the integrity of the plurality 

2 of digitally signed images farther comprises 

3 performing a hash operation on an import table, an export table and an image of 

4 the second digitally signed image to produce a second resultant hash value; 

5 recovering a second hash value from a digital signature contained in the second 

6 digitally signed image; and 

7 comparing the second hash value with the second resultant hash value. 

1 24. An electronic device comprising: 

2 a processor; and 

3 a non-volatile memory component in communication with the processor, the non- 

4 volatile memory component includes including 

5 a post-relocation image being an image of a software module altered by a 

6 symmetrical relocation function upon loading of the image into the memory 

7 component, and 

8 a digital signature based on the image. 

1 25. The electronic device of claim 24, wherein the non- volatile memory 

2 component further includes information for use by the symmetrical relocation fimction to 

3 convert the image into the post-relocation image. 

1 26. The electronic device of claim 25, wherein the information placed within 

2 the non- volatile memory component includes offsets from a starting address of the image 

3 of the software module to a segment of information within the software module. 

1 27. An electronic device comprising: 

2 a processor; and 

3 a memory in communication v^dth the processor, the memory being loaded with a 

4 Bound & Relocated hnport Table (BRIT), an import table, an export table, an image of a 
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5 software module, and a digital signature based on the import table, the export table and 

6 the image. 

1 28. The electronic device of claim 27, wherein the import table loaded within 

2 the memory comprises a plurality of entries, each entry includes an identifier that 

3 indicates what segment of information contained m another digitally signed image is 

4 required by the image. 

1 29. The electronic device of claim 28, wherein the identifier associated with a 

2 particular entry includes a unique sequence of byte values. 

1 30. The elechronic device of claim 27, wherein the export table includes a 

2 plurality of entries formuig a listing of segments of information contained in the image, a 

3 selected entry of the plurality of entries includes an identifier of a segment of information 

4 associated with the segments of information. 

1 31. Embodied in a processor readable medium for execution by a processor, a 

2 software program comprising: 

3 a first software module to reconvert a post-relocation image of a digitally signed 

4 image back to a pre-relocation image, the pre-relocation image being an image of a 

5 software module prior to be altered by a symmetrical relocation fimction; 

6 a second software module to conduct a hash operation on the reconverted, pre- 

7 relocation image to produce a reconverted hash value; 

8 a third software module to recover a hash value fi-om a digital signature contained 

9 in the digitally signed image, the hash value is based on the image of the software 

1 0 module; and 

1 1 a fourth software module to compare the hash value to the reconverted hash value. 

1 32. The software program of claim 3 1 further comprising: 

2 a fifth software module to determine that an integrity of the post-relocation image 

3 remains intact if the hash value matches the reconverted hash value. 
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1 33. The software program of claim 3 1 fiirther comprising a sixth software 

2 module to determine that the post-relocation image has been modified beyond any 

3 modifications caused by relocation when the hash value fails to match the reconverted 

4 hash value. 
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ABSTRACT 



In one embodiment, a digitally signed image is embodied in a memory 
component such as a non-volatile memory. The digitally signed image comprises 
a post-relocation image and a digital signature. The post-relocation image is an 
image of a software module altered by a symmetrical relocation function by 
loading of the image into the memory component. The digital signature is based 
on the image so that it can be used to analyze data integrity. 
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